CVE-2026-42008

Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without...

CVE-2026-33605

An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mode default for community releases, only the attacker's own connection is terminated. If running in high-performance mode default for Pro...

CVE-2026-33605

CVE-2026-33605 affects the Open-Xchange (OX) ManageSieve service. An unauthenticated attacker can crash the managesieve-login process by sending a small malformed command before authenticating. The blast radius depends on the operating mode: in high-security mode (default for community releases),...

PaperCut NG/MF Critical Zero-Day Exploited in the Wild

Overview On August 27, 2026, PaperCut Software published an urgent security advisory stating that it is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF. PaperCut has confirmed customer incidents and is treating the issue as a security emergency. At the...

CVE-2026-81777 WordPress Essential Addons for Elementor plugin <= 6.8.0 - Bypass vulnerability vulnerability

Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing. This issue affects Essential Addons for Elementor: from n/a through 6.8.0...

EUVD-2026-67656

Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing. This issue affects Essential Addons for Elementor: from n/a through 6.8.0...

CVE-2026-81777

Essential Addons for Elementor (WordPress plugin by WPDeveloper) versions up to and including 6.8.0 are affected by an Authentication Bypass by Spoofing vulnerability that enables Identity Spoofing . The issue was discovered by Gaurav popalghat and scored CVSS 5.3 (MEDIUM) , with a network attack...

cve-2024-0012-poc

cve-2024-0012-poc CVE-2024-0012 هو ثغرة أمنية في تجاوز المصادقة في برنامج PAN-OS من Palo Alto Networks. تسمح هذه الثغرة للمهاجمين غير المصادق عليهم بالوصول إلى واجهة الإدارة عبر الشبكة، والحصول على صلاحيات مسؤول PAN-OS، وبالتالي تنفيذ عمليات إدارية، أو العبث بالإعدادات، أو استغلال ثغرات رفع...

CVE-2026-76581

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated wdpssostep1 and wdpssostep2 AJAX actions, where step 1 signs and disclose...

CVE-2025-31161

🚨 CVE-2025-31161 - Bypass critico dell'autenticazione in CrushFTP CVE-2025-31161 è una vulnerabilità critica di bypass dell'autenticazione in CrushFTP, una popolare soluzione di Managed File Transfer MFT. Un attaccante remoto non autenticato può impersonare qualsiasi utente noto incluso l'account...

CVE-2021-37580

Apache ShenYu Admin weist eine Sicherheitslücke zur Authentifizierungsumgehung auf, über die Angreifer die JSON Web Token JWT-Sicherheitsauthentifizierung umgehen und direkt auf das System-Backend zugreifen können. Apache ShenYu ist eine erweiterbare, leistungsstarke, reaktive API-Gateway-Lösung,...

CVE-2024-51996

⚠️ CVE-2024-51996 - Exploit di Bypass dell'Autenticazione Symfony RememberMe Exploit per la vulnerabilità critica CVE-2024-51996 , che consente il bypass dell'autenticazione nelle applicazioni Symfony che utilizzano il meccanismo Remember Me. 🧠 Impatto : Impersonazione di utenti privilegiati come...

CVE-2019-6340-Drupal-8.6.9-REST-Auth-Bypass

CVE-2019-6340 / SA-CORE-2019-003 Tre script inclusi per dimostrare come Drupal 8.6.9 sia vulnerabile a CVE-2019-6340: createnodeviarest.py - Esempio di creazione di un nodo autenticato normale con API REST doesnotcorrespond.py - Prova che la richiesta viene elaborata anche senza autenticazione...

CVE-2026-76581 WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated wdpssostep1 and wdpssostep2 AJAX actions, where step 1 signs and disclose...

CVE-2026-76581

CVE-2026-76581 is a Critical (CVSS 9.8) unauthenticated Authentication Bypass in the WPMU DEV Dashboard plugin for WordPress (≤ 5.0.1 , ~350,000 installs). The root cause is HMAC canonicalization confusion between two unauthenticated AJAX actions: wdpsso_step1 signs an unseparated concatenation o...

EUVD-2026-67464

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated wdpssostep1 and wdpssostep2 AJAX actions, where step 1 signs and disclose...

CVE-2023-27100

CVE-2023-27100 - pfSense Umgehung des Anti-Brute-Force-Schutzes Problembeschreibung Das Authentifizierungssystem versucht, informativ zu sein und zusätzliche Informationen zusammen mit IP-Adressen auszugeben, um vollständig zu identifizieren, von wo aus sich ein Benutzer anmeldet, wenn er sich üb...

Alibab-Nacos-Unauthorized-Login

Impatto della vulnerabilità È stato scoperto un problema in Nacos che interessa Nacos = 2.1.0. Gli utenti di Nacos utilizzano la chiave JWT predefinita, causando una vulnerabilità di accesso non autorizzato. Attraverso questa vulnerabilità, gli aggressori possono aggirare l'autenticazione con nom...

EUVD-2026-67578

SOY Gallery contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product...

CVE-2026-73827

SOY Calendar is affected by a cross-site scripting (XSS) vulnerability that allows an arbitrary script to be executed in the web browser of a user who is logging into the product. The vulnerability requires low privileges and active user interaction , with a CVSS 3.0 base score of 5.4 (MEDIUM) an...